Download Payment Batch File

The stored pain.001 bytes — 409 unless approved/exported.

The first download stamps approved → exported (+ who/when), so this GET mutates and runs inside db.tx() (idempotent — only that one edge writes). That first download is the release: it re-checks every bill first (ZENO-231) and answers 422 {"msg"} — stamping nothing — when one was paid, credited, re-batched or edited since approval; cancel the batch and create a new one. Re-downloading an exported batch serves the same bytes.

Accountant/owner despite being a GET (ZCT-257). The role sweep enumerates routes by VERB, so a write behind a GET is structurally invisible to it — this is the live instance of the blind spot that sweep's docstring names. A plain member could otherwise download the bank payment-instruction file AND advance the batch's state, stamping themselves as the exporter on a document that goes to the bank.